Skip to content

SILO Console 2.7.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Nov 19:15
· 1 commit to main since this release
v2.7.1
This tag was signed with the committer’s verified signature.
Vonng Feng Ruohang
GPG key ID: E7935D8DB9BD8B20
Verified
Learn about vigilant mode.
3825ebc

Service-account policy inheritance preservation, strict policy JSON validation across Console APIs and UI editors, modal save-error feedback, and released silo-pkg 3.16.1 / mcli 20261112 dependencies.

Compatibility notes · 中文兼容性注记 · Changes from 2.7.0

Changes

  • Service-account policy inheritance (SN-2026-025): tracks inherited and inline policies separately (1be8a74bf), so editing an access key's name, description, expiry or status preserves inheritance instead of freezing a copy of the parent's policy or failing when the parent policy exceeds the 4 KiB inline-policy limit. Turning off Restrict beyond user policy sends an explicit empty policy to restore inheritance (when paired with the matching SILO Server update).
  • Empty inline-policy guard & modal error feedback: while Restrict beyond user policy remains enabled, creating or replacing an inline policy rejects an empty editor, {}, {"Statement":[]}, {"Statement":null}, and backend-accepted case-insensitive/Unicode-folded or duplicate-key empty variants (a1a84cab4, 1fdb279fd, 3825ebc44), while still allowing metadata-only saves on unchanged historical empty inline policies. Save errors now render inside the edit modal instead of failing silently behind the dialog.
  • Strict policy JSON validation: Console policy validation rejects unknown JSON fields, trailing payloads, non-object documents, empty Principal: {} / unsupported NotPrincipal blocks, and empty named policies (3825ebc44), aligned with silo-pkg v3.16.1.
  • Dependencies: built with Go 1.27.4, github.com/pgsty/silo-pkg/v3 v3.16.1, and pgsty/mc RELEASE.2026-11-12T00-00-00Z (v0.0.0-20261111180825-a37a9f054fba), verified against the Go module proxy, checksum database, and immutable GitHub release metadata.

变更摘要（中文）

  • 服务账号策略继承保护（SN-2026-025）： 区分继承策略与内联会话策略（1be8a74bf），仅编辑服务账号名称、备注、有效期或启用状态时保留继承关系，不再将父账号策略固化为内联副本，也不会因父级有效策略超过 4 KiB 内联上限而阻断禁用等管理操作。关闭 Restrict beyond user policy 会发送显式空策略以恢复继承（需配合包含对应修复的 SILO Server）。
  • 空内联策略拦截与弹窗错误提示： 开启 Restrict beyond user policy 创建或替换策略时，拦截空编辑器、{}、{"Statement":[]}、{"Statement":null} 以及后端大小写/Unicode 折叠与重复键空文档变体（a1a84cab4、1fdb279fd、3825ebc44），同时允许未改动历史空内联策略的账号执行纯元数据修改；保存报错直接在编辑弹窗内展示。
  • 严格策略 JSON 校验与依赖更新： 后端接口拒绝未知策略字段、尾部多余载荷、空 Principal: {} / NotPrincipal 及空命名策略（3825ebc44）；升级依赖至正式发布的 silo-pkg v3.16.1 与 mcli 20261112。

Upgrade note: standalone Console v2.7.1 preserves metadata-only edits immediately, while explicit reset-to-inheritance (policy: "{}") requires the matching post-20261109 SILO Server update. Updating standalone Console does not replace the Console embedded in an existing SILO Server binary.

Verification

Source: 3825ebc44451fdc8eefda3d4ec523a79dfecb236.

Image: docker.io/pgsty/silo-console:v2.7.1 (Linux amd64/arm64), digest sha256:2afef06f8505eadb24d657acd0f68c78bce8b148b1d9b74981454560fa3b055f.

The assets are:

  • six platform executables and bundles;
  • nine Linux packages;
  • the source archive and SPDX SBOMs;
  • the legal notices;
  • a signed SHA-256 manifest.

The tag workflow verifies the checksum and image signatures, the image SBOM attestations and the GitHub provenance. See the verification contract.

Assets 46
Loading